Repository navigation
feat: crash-safe process-external Linux AppImage handoff - #291
Merged
Merged
Conversation
AppImageHosts that exit to apply an update cannot run the swap themselves: a crash between moving the old AppImage aside and moving the new one into place leaves no executable at the launch path, and the dead process could never run recovery. AppImageHandoff::LaunchReplacement (the Linux counterpart of MsiHandoff) writes a generated first-party shell script, detaches it, and lets the updating process exit after releasing its single-instance lease. The script waits a bounded time for the launching process, serializes concurrent helpers through a self-healing lock, performs the atomic replace with staging, SHA-256 re-check, schema-1 journal phases, and idempotent rollback, relaunches the replacement, and commits only after it survives the settle window. Failures record a failure marker for ConsumeFailure/CleanupStaleAttempts on the next launch, and a preflight heals attempts that died between the two renames. Closes #290.
journal_writer takes the pre-rendered journal record, waitpid and chmod need their headers, and the detached helper does not need a working directory change since every path it sees is absolute.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #290.
What
Adds
AppImageHandoffto the linkedrivet::platformtarget — the Linux counterpart of the WindowsMsiHandoff. A GTK host applying an AppImage update must not run the swap itself: a crash between moving the old AppImage aside and moving the new one into place leaves no executable at the launch path, and the dead process could never run recovery. Instead,LaunchReplacementwrites a generated first-party shell script into a process-specific attempt directory and detaches it, so the updating process can exit right after releasing its single-instance lease.Lifecycle (mirrors the issue's requested API)
download-update+verify-update-artifact!output); the script re-checks size-independent SHA-256 before anything moves.release_leasecallback runs.exit_timeout_seconds) for the launching process to exit; a miss recordsprocess-exit-timeout.execute-platform-installation!: staging copy beside the target, renamed swap, schema-1 journal phases, idempotent rollback gated by the signed manifest's rollback policy. Concurrency is serialized by a self-healing lock (stale owner PID is reaped).failure.txt.ConsumeFailure/CleanupStaleAttemptscomplete the startup lifecycle, mirroring Windows.The journal lives at the deterministic sibling path
<target>.rivet-handoff-journalwith the same fields and phases as the runtime transaction, so an interrupted handoff stays recoverable withrecover-platform-installation!. A preflight heals attempts that died between the two renames, so the launch path is never left without an executable.Validation
platform/linux/Integration/update_handoff_test.cppnow drives the real detached helper end to end on Linux CI: healthy commit, unhealthy rollback, rollback-forbidden, digest mismatch, and exit-timeout scenarios (wired into the Linux roundtrip job).rivet/tests/linux-update-handoff.rktpins the generated lifecycle semantics on every host, in the same style as the Windows handoff guard;raco test rivet/tests/passes locally (10119 tests).